An AI agent should not receive the same access rights as the person who starts it. People can assess context, consequences and exceptions. An agent operates according to model output, tool descriptions and the limits of its runtime. If it is given unrestricted access by default, an error can quickly become a real action.
The right starting principle is least privilege: The agent receives only the data and tools it needs for a clearly defined task. Write access, exports and external communications are handled separately.
Why User Permissions Should Not Simply Be Inherited
An employee may be able to read, edit, export and delete data in a CRM. A research agent may only need read access to selected fields. A support agent may be allowed to draft a response without necessarily being allowed to send it or export customer data.
If agents automatically inherit all user permissions, the potential damage from prompt injection, incorrect tool selection or ambiguous instructions increases. Permissions must therefore fit the task, not just the user's identity.
Model Permissions Across Four Layers
A practical permissions architecture separates:
- Sources: Which documents, databases and projects may the agent read?
- Tools: Which APIs and functions may it call at all?
- Actions: Is it restricted to reading, or may it also write or perform irreversible steps?
- Scope: Which record, period, customer or amount does the permission cover?
A tool called "CRM" is too broad. Reading a contact, updating a note, exporting a list and deleting a record are distinct capabilities and require separate rules.
Temporary Rather Than Permanent Permissions
Many agent tasks are time-limited. Short-lived tokens, task-specific scopes and expiry times are better suited to them than permanent API keys. The permission should expire when the task is completed or terminated.
Binding access to a purpose is equally important. An agent assigned to review ten specified invoices does not need unrestricted access to the entire finance archive.
What Prompt Injection Has to Do with Permissions
Prompt injection cannot be solved through better system prompts alone. When an agent reads external content, that content may attempt to influence its behaviour. The most effective damage limitation therefore sits outside the model: narrow tool permissions, separate write functions, data filters, confirmations and logging.
The agent must be technically unable to perform an unauthorised action. An instruction such as "Ignore previous rules" is then less dangerous because the runtime enforces the boundary.
Tier Approvals by Impact
Not every action requires the same level of control. A sensible tiering is:
- Reading within an authorised scope can happen automatically.
- Drafts are created but not sent.
- Changes to business data require a preview and confirmation.
- Payments, deletions and public communications require explicit approval.
The approval must show exactly what will happen. A generic "Continue agent?" prompt is not enough.
Test Permissions Regularly
Documented rules are only the beginning. Test negative cases: Can the agent access another project? Can it indirectly export data through an authorised tool? Can a tool call exceed the defined scope? Are expired permissions actually rejected?
These tests belong in the initial implementation and in every change to tools, models or connectors.
Sources
- OWASP, Top 10 for LLM Applications: https://owasp.org/www-project-top-10-for-large-language-model-applications/
- NIST, Zero Trust Architecture: https://csrc.nist.gov/publications/detail/sp/800-207/final
- Model Context Protocol, Authorization: https://modelcontextprotocol.io/specification/latest/basic/authorization
- Anthropic, Mitigating jailbreaks and prompt injections: https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks
Next Step
Take one planned agent and list every required action separately. Distinguish between reading, writing, exporting, sending and deleting. Remove every permission that is not needed for the first pilot, then test at least five explicitly prohibited actions.